Skip to content

Commit e20aca8

Browse files
cx-atish-jadhavcx-atish-jadhav
committed
added zizmor check
1 parent 3edea22 commit e20aca8

9 files changed

Lines changed: 110 additions & 26 deletions

‎.github/workflows/auto-merge-pr.yml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,24 @@
11
name: Post-Check Actions
22
on: [pull_request]
33

4-
permissions:
5-
contents: write
4+
concurrency:
5+
group: ${{ github.workflow }}-${{ github.ref }}
6+
cancel-in-progress: true
7+
8+
permissions: {}
69

710
jobs:
811
dependabot-merge:
12+
name: Auto-merge CLI update PR
913
runs-on: cx-public-ubuntu-x64
1014
if: contains(github.head_ref, 'feature/update_cli')
15+
permissions:
16+
contents: write # for gh pr merge and auto-approve
1117
steps:
1218
- name: Enable auto-merge for Dependabot PRs
1319
env:
14-
PR_URL: ${{github.event.pull_request.html_url}}
15-
GITHUB_TOKEN: ${{secrets.PERSONAL_ACCESS_TOKEN }}
20+
PR_URL: ${{ github.event.pull_request.html_url }}
21+
GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
1622
run: gh pr merge --auto --squash "$PR_URL"
1723
- name: Auto approve dependabot PRs
1824
uses: step-security/auto-approve-action@0c28339628c8e79ab2f6813291e7e6cd584b4d30 # v4.0.0

‎.github/workflows/checkmarx-one-scan.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,22 @@ on:
88
schedule:
99
- cron: '00 7 * * *' # Every day at 07:00
1010

11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
permissions:
16+
contents: read
17+
1118
jobs:
1219
cx-scan:
1320
name: Checkmarx One Scan
1421
runs-on: cx-public-ubuntu-x64
1522
steps:
1623
- name: Checkout
1724
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
25+
with:
26+
persist-credentials: false
1827
- name: Checkmarx One CLI Action
1928
uses: checkmarx/ast-github-action@ef93013c95adc60160bc22060875e90800d3ecfc #v.2.3.19
2029
with:

‎.github/workflows/ci.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,17 @@
11
name: AST Javascript wrapper CI
22

33
on: [ pull_request ]
4+
5+
concurrency:
6+
group: ${{ github.workflow }}-${{ github.ref }}
7+
cancel-in-progress: true
8+
49
permissions:
510
contents: read
611

712
jobs:
813
unit-tests:
14+
name: Unit Tests
915
runs-on: cx-public-ubuntu-x64
1016
steps:
1117
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v6
@@ -33,9 +39,12 @@ jobs:
3339

3440
run: npm run test:unit
3541
integration-tests:
42+
name: Integration Tests
3643
runs-on: cx-public-ubuntu-x64
3744
steps:
3845
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
46+
with:
47+
persist-credentials: false
3948
- name: Verify single lockfile (Step 0 - Supply Chain Policy)
4049
run: |
4150
if [ -f yarn.lock ] && [ -f package-lock.json ]; then

‎.github/workflows/delete-packages-and-releases.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,19 @@ on:
1313
description: 'Tag to delete'
1414
required: true
1515

16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: false
19+
1620
permissions:
1721
contents: read
1822

1923
jobs:
2024
delete:
25+
name: Delete packages and releases
2126
permissions:
22-
contents: write
23-
packages: write
27+
contents: write # for gh release delete and tag cleanup
28+
packages: write # for deleting npm package versions
2429
runs-on: cx-public-ubuntu-x64
2530
steps:
2631

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,29 @@
11
name: Dependabot auto-merge
22
on: pull_request
33

4-
permissions:
5-
contents: write
4+
concurrency:
5+
group: ${{ github.workflow }}-${{ github.ref }}
6+
cancel-in-progress: true
7+
8+
permissions: {}
69

710
jobs:
811
dependabot-merge:
12+
name: Auto-merge Dependabot PR
913
runs-on: cx-public-ubuntu-x64
10-
if: ${{ github.actor == 'dependabot[bot]' }}
14+
if: github.event.pull_request.user.login == 'dependabot[bot]'
15+
permissions:
16+
contents: write # for gh pr merge and auto-approve
1117
steps:
1218
- name: Dependabot metadata
1319
id: metadata
1420
uses: step-security/dependabot-fetch-metadata@bf8fb6e0be0a711c669dc236de6e7f7374ba626e # v3.1.0
1521
with:
16-
github-token: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
22+
github-token: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
1723
- name: Enable auto-merge for Dependabot PRs
1824
env:
19-
PR_URL: ${{github.event.pull_request.html_url}}
20-
GITHUB_TOKEN: ${{secrets.PERSONAL_ACCESS_TOKEN }}
25+
PR_URL: ${{ github.event.pull_request.html_url }}
26+
GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
2127
run: gh pr merge --auto --squash "$PR_URL"
2228
- name: Auto approve dependabot PRs
2329
uses: step-security/auto-approve-action@0c28339628c8e79ab2f6813291e7e6cd584b4d30 # v4.0.0

‎.github/workflows/nightly.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@ on:
88
branches:
99
- main
1010

11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: false
14+
1115
jobs:
1216
nightly:
13-
uses: Checkmarx/ast-cli-javascript-wrapper-runtime-cli/.github/workflows/release.yml@main
14-
secrets: inherit
17+
uses: Checkmarx/ast-cli-javascript-wrapper-runtime-cli/.github/workflows/release.yml@main # zizmor: ignore[unpinned-uses]
18+
secrets: inherit # zizmor: ignore[secrets-inherit]

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -44,24 +44,29 @@ on:
4444
default: true
4545
type: boolean
4646

47+
concurrency:
48+
group: ${{ github.workflow }}-${{ github.ref }}
49+
cancel-in-progress: false
50+
4751
permissions:
4852
contents: read
4953

5054
jobs:
5155
delete:
5256
permissions:
53-
contents: write
54-
packages: write
55-
uses: Checkmarx/ast-cli-javascript-wrapper-runtime-cli/.github/workflows/delete-packages-and-releases.yml@main
57+
contents: write # for gh release delete and tag cleanup
58+
packages: write # for deleting npm package versions
59+
uses: Checkmarx/ast-cli-javascript-wrapper-runtime-cli/.github/workflows/delete-packages-and-releases.yml@main # zizmor: ignore[unpinned-uses]
5660
with:
5761
tag: ${{ inputs.jsTag }}
58-
secrets: inherit
62+
secrets: inherit # zizmor: ignore[secrets-inherit]
5963
if: inputs.dev == true
6064
release:
65+
name: Release
6166
permissions:
62-
id-token: write
63-
contents: write
64-
packages: write
67+
id-token: write # allows this job to request a GitHub OIDC token
68+
contents: write # for git tag push and creating the GitHub release
69+
packages: write # for publishing the npm package to GitHub Packages
6570
runs-on: cx-public-ubuntu-x64
6671
env:
6772
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -181,8 +186,8 @@ jobs:
181186
- name: Push tag
182187
if: inputs.dev == false
183188
run: |
184-
git pull
185-
git tag ${{env.TAG_NAME}}
189+
git pull
190+
git tag "$TAG_NAME"
186191
git push --tags
187192
188193
- name: Publish npm package

‎.github/workflows/scan-github-action.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Scan for GitHub Actions issues
2+
3+
on:
4+
pull_request:
5+
workflow_call:
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }}
9+
10+
permissions: {}
11+
12+
jobs:
13+
zizmor:
14+
name: Scan repository contents
15+
runs-on: cx-private-ubuntu-x64
16+
permissions:
17+
contents: read
18+
steps:
19+
- name: Check out repository
20+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
21+
with:
22+
persist-credentials: false
23+
24+
- name: Run Zizmor linter
25+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
26+
with:
27+
advanced-security: false
28+
annotations: false
29+
persona: pedantic
30+
fail-on-no-inputs: false
31+
online-audits: false

‎.github/workflows/update-cli.yml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,31 @@ on:
77
description: 'New CLI version (optional)'
88
required: false
99

10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: false
13+
1014
permissions:
1115
contents: read
1216

1317
jobs:
1418
update-checkmarx-cli:
19+
name: Update Checkmarx AST CLI
1520
runs-on: cx-public-ubuntu-x64
1621

1722
steps:
1823
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
24+
with:
25+
persist-credentials: false
1926

2027
# Fetch the latest Checkmarx AST CLI version
2128
- name: Get Latest Checkmarx API version
2229
id: checkmarx-ast-cli
30+
env:
31+
NEW_CLI_VERSION: ${{ github.event.inputs.new_cli_version }}
2332
run: |
24-
if [ "${{ github.event.inputs.new_cli_version }}" ]; then
25-
LATEST_VERSION=${{ github.event.inputs.new_cli_version }}
33+
if [ "$NEW_CLI_VERSION" ]; then
34+
LATEST_VERSION="$NEW_CLI_VERSION"
2635
else
2736
LATEST_VERSION=$(curl -sL https://api.github.com/repos/Checkmarx/ast-cli/releases/latest | jq -r ".tag_name")
2837
fi
@@ -36,7 +45,7 @@ jobs:
3645
env:
3746
RELEASE_TAG: ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
3847
run: |
39-
echo ${{ steps.checkmarx-ast-cli.outputs.release_tag }} > checkmarx-ast-cli.version
48+
echo "$RELEASE_TAG" > checkmarx-ast-cli.version
4049
4150
# Download CLI binaries and generate checksums
4251
- name: Download CLI and generate checksums

0 commit comments

Comments
 (0)